Sandboxing of Chinese converter

[Changaco]

Liberapay supports automatic conversion between Traditional and Simplified Chinese texts thanks to OpenCC. Sadly, that library is unsafe. Ideally it would be rewritten in a safe programming language, but in the meantime Liberapay should be modified to only use it in sandboxed sub-processes.

[anosvoldi883]

I understand the concern here. Since OpenCC isn’t memory-safe, running it in-process poses a real risk.

A possible direction could be isolating the conversion in a sandboxed subprocess (with restricted permissions) and communicating via stdin/stdout, as an interim mitigation.

I’d like to explore this and propose a safe approach—please let me know if that aligns with the maintainers’ expectations.